In modern software development, developers frequently need to understand code behavior at a glance—whether reviewing pull requests, debugging issues, or navigating unfamiliar codebases. This ability to reason about dynamic program behavior is fundamental to effective software engineering and increasingly supported by Large Language Models (LLMs). However, existing studies on code reasoning focus primarily on isolated code snippets, overlooking the complexity of real-world scenarios involving external API interactions and unfamiliar functions. This gap hinders our understanding of what truly makes code reasoning challenging for LLMs across diverse programming contexts.

Complex logic errors in LLM-generated code are challenging to diagnose and repair. While existing LLM-based self-repair approaches conduct intensive static semantic analysis or rely on superficial execution logs, they miss the in-depth runtime behaviors that often expose bug root causes—lacking the interactive dynamic analysis capabilities that make human debugging effective. We present InspectCoder, the first agentic program repair system that empowers LLMs to actively conduct dynamic analysis via interactive debugger control. Our dual-agent framework enables strategic breakpoint placement, targeted state inspection, and incremental runtime experimentation within stateful debugger sessions. Unlike existing methods that follow fixed log collection procedures, InspectCoder adaptively inspects and perturbs relevant intermediate states at runtime, and leverages immediate process rewards from debugger feedback to guide multi-step reasoning, transforming LLM debugging paradigm from blind trial-and-error into systematic root cause diagnosis. We conduct comprehensive experiments on two challenging self-repair benchmarks: BigCodeBench-R and LiveCodeBench-R. InspectCoder achieves 5.10%–60.37% relative improvements in repair accuracy over the strongest baseline, while delivering 1.67x-2.24x superior bug-fix efficiency respectively.We also contribute InspectWare, an open-source middleware that abstracts debugger complexities and maintains stateful debugging sessions across mainstream Python testing frameworks. Our work provides actionable insight into the interactive LLM-debugger systems, demonstrating the significant potential of LLM-driven dynamic analysis for automated software engineering.

Yunkun Wang, Yue Zhang, Zhen Qin, Chen Zhi, Binhua Li, Fei Huang, Yongbin Li, Shuiguang Deng. Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 2025.

In representation learning for Web temporal knowledge bases, each node in Web knowledge bases carries a specific contextual meaning. Existing services often neglect the implicit semantic Web knowledge behind entities and relations, thus failing to effectively capture the knowledge representation of temporal Web knowledge bases. To address this issue, this paper develops an autocompletion service for temporal Web knowledge bases, which is based on multisource semantic feature learning and feature fusion. We construct a semantic model oriented toward external semantic Web repositories to supplement entity-relation descriptions, and our service leverages the pretrained language model BERT, effectively learning semantic knowledge features. Additionally, our service captures the textual features of quadruples using a recurrent neural network, constructs a historical sparse timestamp matrix, and generates a mask tensor, successfully obtaining the weights of potentially correct entities, and thereby capturing the historical features of quadruples. Furthermore, our service integrates complementary features from different modules through an attention mechanism. Experimental validation shows that our service outperforms existing approaches in terms of four evaluation metrics: mean reciprocal rank (MRR), Hits@1, Hits@3, and Hits@10. The results also exhibit that it improves the accuracy and performance for autocompletion service for temporal Web knowledge bases.

Snapshot technology is crucial for data protection and system recovery in virtualized environments, particularly with the growing need for continuous snapshots to maintain the integrity of long-running web-based and distributed applications. However, traditional snapshot methods often suffer from performance bottlenecks, and inefficient storage usage. These challenges are closely tied to the way memory pages are accessed during VM execution, where memory access patterns show significant disparities between frequently accessed "hot" pages and less-used "cold" pages. In this paper, we introduce HeatSnap, a continuous snapshot system designed to address these issues by leveraging the uneven access frequencies of memory pages. HeatSnap distinguishes between intensive hot pages and dirty pages, applying specialized snapshotting and storage strategies to optimize the handling of both hot and cold memory regions. This approach aims to optimize snapshot efficiency, minimize performance impact on the VM, and decrease storage costs. Our implementation of HeatSnap on QEMU/KVM demonstrates significant improvements in VM performance loss, snapshot duration, and storage efficiency compared to existing methods, as evidenced by evaluations on common web and cloud-based workloads.

Existing approaches defend against backdoor attacks in federated learning (FL) mainly through a) mitigating the impact of infected models, or b) excluding infected models. The former negatively impacts model accuracy, while the latter usually relies on globally clear boundaries between benign and infected model updates. However, in reality, model updates can easily become mixed and scattered throughout due to the diverse distributions of local data. This work focuses on excluding infected models in FL. Unlike previous perspectives from a global view, we propose Snowball, a novel anti-backdoor FL framework through bidirectional elections from an individual perspective inspired by one principle deduced by us and two principles in FL and deep learning. It is characterized by a) bottom-up election, where each candidate model update votes to several peer ones such that a few model updates are elected as selectees for aggregation; and b) top-down election, where selectees progressively enlarge themselves through picking up from the candidates. We compare Snowball with state-of-the-art defenses to backdoor attacks in FL on five real-world datasets, demonstrating its superior resistance to backdoor attacks and slight impact on the accuracy of the global model.

Log parsing is an essential step for log analysis, which transforms raw log messages into structured form by extracting the log templates. Automatic log parsing have been the subject of extensive research. Recently, several studies have explored improving the performance of automatic log parsing via deep-learning-based approaches, especially for the pre-trained language models. However, the use of such large-scale language models for log parsing encounters several challenges, including hallucinations, high-cost and labelling efforts. To address these challenges, this paper introduces YALP, a zero-shot log parsing solution that tackles the aforementioned challenges by utilizing the capabilities of ChatGPT in conjunction with traditional methods, without incorporating user labelling. Our experiments on 16 public log datasets shows that our method outperforms several popular traditional methods in commonly used evaluation metrics. In comparison to directly utilizing GPT for log parsing tasks, our methods demonstrates significant improvements in both efficiency and effectiveness.

Automated Program Repair (APR) aims to fix bugs by generating patches. And existing work has demonstrated that "pre-training and fine-tuning" paradigm enables Large Language Models (LLMs) improve fixing capabilities on APR. However, existing work mainly focuses on Full-Model Fine-Tuning (FMFT) for APR and limited research has been conducted on the execution-based evaluation of Parameter-Efficient Fine-Tuning (PEFT) for APR. Comparing to FMFT, PEFT can reduce computing resource consumption without compromising performance and has been widely adopted to other software engineering tasks.

Abstract Deep learning (DL) techniques have grown in leaps and bounds in both academia and industry over the past few years. Despite the growth of DL projects, there has been little study on how DL projects evolve, whether maintainers in this domain encounter a dramatic increase in workload and whether or not existing maintainers can guarantee the sustained development of projects. To address this gap, we perform an empirical study to investigate the sustainability of DL projects, understand maintainers' workloads and workloads growth in DL projects, and compare them with traditional open‐source software (OSS) projects. In this regard, we first investigate how DL projects grow, then, understand maintainers' workload in DL projects, and explore the workload growth of maintainers as DL projects evolve. After that, we mine the relationships between maintainers' activities and the sustainability of DL projects. Eventually, we compare it with traditional OSS projects. Our study unveils that although DL projects show increasing trends in most activities, maintainers' workloads present a decreasing trend. Meanwhile, the proportion of workload maintainers conducted in DL projects is significantly lower than in traditional OSS projects. Moreover, there are positive and moderate correlations between the sustainability of DL projects and the number of maintainers' releases, pushes, and merged pull requests. Our findings shed lights that help understand maintainers' workload and growth trends in DL and traditional OSS projects and also highlight actionable directions for organizations, maintainers, and researchers.

Fund loss is an increasingly critical problem caused by the misbehavior of software, especially in fintech and e-commerce platforms. Data reconciliation is one of the most commonly used approaches in detecting and preventing fund loss by executing reconciliation scripts on data storage systems (e.g., database and cache systems). The core of reconciliation scripts is the data constraints, which can be expressed as implications with two parts: preconditions and assertions. However, due to the complexity and diversity of business, the construction of data constraints and reconciliation scripts usually heavily relies on business experts. To this end, we propose AutoReconciler to mine data constraints from business data and generate reconciliation scripts automatically. It can mine assertions via enhanced symbolic regression, discover preconditions via association rule mining, and generate reconciliation scripts in SQL form. We have performed extensive experiments on the synthesized data. The result shows that our approach outperforms the baseline by a large margin (an average improvement in precision and recall of 22.1% and 51.6%, respectively), especially for complex data constraints. Our solution has been implemented, deployed, and adopted in production, and we conducted several case studies further to confirm the benefits of our solution in industrial scenarios.

Deep learning tasks (DLT) include training and inference tasks, where training DLTs have requirements on minimizing average job completion time (JCT) and inference tasks need sufficient GPUs to meet real-time performance. Unfortunately, existing work separately deploys multi-tenant training and inference GPU cluster, leading to the high JCT of training DLTs with limited GPUs when the inference cluster is under insufficient GPU utilization due to the periodic inference workload. DeepBoot solves the challenges by utilizing idle GPUs in the inference cluster for the training DLTs. Specifically, 1) DeepBoot designsadaptive task scaling(ATS) algorithm to allocate GPUs in the training and inference clusters for training DLTs and minimize the performance loss when reclaiming inference GPUs. 2) DeepBoot implementsauto-fast elastic(AFE) training based on Pollux to reduce the restart overhead by inference GPU reclaiming. Our implementation on the testbed and large-scale simulation in Microsoft deep learning workload shows that DeepBoot can achieve 32% and 38% average JCT reduction respectively compared with the scheduler without utilizing idle GPUs in the inference cluster.

In mobile computing scenarios, federation learning allows users to jointly train global models in a decentralized manner without exposing private data. However, due to the heterogeneity of the network and devices, the traditional global model often fails to fit the user data distribution, which is inconsistent with the primary condition of federation learning, resulting in accuracy decreasing of global models. Besides, the security of federated learning is decreasing with the increase of malicious attacks. To address the aforementioned issues, in this paper, we explore the cosine similarity of model gradients and design a clustered mechanism to improve learning efficiency. Furthermore, we combine the clustered federated learning with the blockchain-supported fog computing networks, which could verify local models uploaded by users and generate the traceable global models to improve the learning efficiency. Finally, we conduct experiments on several frameworks with the real-world dataset FEMNIST, and the experimental results demonstrate the efficiency and robustness of the blockchain-enabled clustered federated learning framework.

Logging is a common practice to collect valuable runtime information about software systems. However, information written to log files can be sensitive and give valuable guidance to attackers. In fact, information exposure through logging is not uncommon. Even large-scale online services (e.g., Facebook and Twitter) have reported exposing sensitive information via log files, and hundreds of millions of users are affected. Despite the severity of such vulnerabilities, there is no existing work that studies such vulnerabilities in the real-world context, and we have little knowledge about them. To fill this gap, we conduct a preliminary study on 413 real-world vulnerabilities to investigate the exploitability and root causes of such vulnerabilities. By analyzing these vulnerabilities, we find that 1) about two-third (67.8%) vulnerabilities can be exploited via the network, and a significant amount (89.3%) of vulnerabilities can be exploited with low efforts; 2) malicious users and insiders can use about half of (46.9%) proof-of-concept exploits to launch attacks without any expertise; 3) the top three common root causes for the vulnerabilities are insecure whole-object logging (43.4%), incorrect permission assignment (17.5%), and improper implementation of sanitization (11.2%). Based on the findings, we also discuss the implications for researchers and practitioners. We believe our work can inspire further work on detecting and fixing the vulnerabilities.

Deep Learning techniques have been prevalent in various domains, and more and more open source projects in GitHub rely on deep learning libraries to implement their algorithms. To that end, they should always keep pace with the latest versions of deep learning libraries to make the best use of deep learning libraries. Aptly managing the versions of deep learning libraries can help projects avoid crashes or security issues caused by deep learning libraries. Unfortunately, very few studies have been done on the dependency networks of deep learning libraries. In this paper, we take the first step to perform an exploratory study on the dependency networks of deep learning libraries, namely, Tensorflow, PyTorch, and Theano. We study the project purposes, application domains, dependency degrees, update behaviors and reasons as well as version distributions of deep learning projects that depend on Tensorflow, PyTorch, and Theano. Our study unveils some commonalities in various aspects (e.g., purposes, application domains, dependency degrees) of deep learning libraries and reveals some discrepancies as for the update behaviors, update reasons, and the version distributions. Our findings highlight some directions for researchers and also provide suggestions for deep learning developers and users.

To assure high software quality for large-scale industrial software systems, traditional approaches of software quality assurance, such as software testing and performance engineering, have been widely used within Alibaba, the world's largest retailer, and one of the largest Internet companies in the world. However, there still exists a high demand for software quality assessment to achieve high sustainability of business growth and engineering culture in Alibaba. To address this issue, we develop an industrial solution for software quality assessment by following the GQM paradigm in an industrial setting. Moreover, we integrate multiple assessment methods into our solution, ranging from metric selection to rating aggregation. Our solution has been implemented, deployed, and adopted at Alibaba: (1) used by Alibaba's Business Platform Unit to continually monitor the quality for 60+ core software systems; (2) used by Alibaba's R&D Efficiency Unit to support group-wide quality-aware code search and automatic code inspection. This paper presents our proposed industrial solution, including its techniques and industrial adoption, along with the lessons learned during the development and deployment of our solution.

Logging components are an integral element of software systems. These logging components receive the logging requests generated by the logging code and process these requests according to logging configurations. Logging configurations play an important role on the functionality, performance, and reliability of logging. Although recent research has been conducted to understand and improve current practice on logging code, no existing research focuses on logging configurations. To fill this gap, we conduct an exploratory study on logging configuration practice of 10 open-source projects and 10 industrial projects written in Java in various sizes and domains. We quantitatively show how logging configurations are used with respect to logging management, storage, and formatting. We categorize and analyze the change history (1,213 revisions) of logging configurations to understand how the logging configurations evolve. Based on these study results, we reveal 10 findings about current practice of logging configurations. As a proof of concept, we develop a simple detector based on some of our findings. We apply our detector on three popular open-source projects and identify three long-lived issues (more than two years). All these issues are confirmed and two of them have been fixed by the open-source developers.

Summary Monitoring is a precondition for intelligent management in cloud computing environment, such as dynamic resource allocation. Typically, working as an auxiliary tool, a monitoring system is expected to incur the least additional resource usage, thus the strategies to improve the efficiency of monitoring mechanisms become significant. Yet the scale and monitoring requirement of different data centers vary, we cannot determine whether a monitoring mechanism would work well in a new data center before it serves the data center. To evaluate monitoring mechanisms, we proposeSimMon, a toolkit for simulating monitoring mechanisms in cloud computing environments.SimMonis designed to simulate the topologies, actions, and strategies in data collection, dissemination, storage, and management processes.SimMonprovides a controllable and repeatable way to evaluate monitoring mechanisms. In this paper, we describe the requirements analysis, design, implementation, and evaluation ofSimMon. We simulate several different monitoring systems and compare their cost on time and resource to evaluate the efficiency ofSimMon. We reproduce two usage scenarios from former literatures to demonstrate the effectiveness ofSimMonon monitoring mechanisms simulation and evaluation. We build a real‐world working environment to validate the capability ofSimMonon mimicking the characteristics of cloud monitoring systems. Copyright © 2016 John Wiley & Sons, Ltd.

Nowadays, numerous enterprises are migrating their applications into cloud computing environments. Typically, the applications are composed of several dependent service components that span many hosts and network devices. In light of this, exploring the dependency between service components can be beneficial for achieving fast network application response time. Moreover, it is significant to consolidate service components according to resource constraints, service dependency, and network structure. However, it is a tedious task to discover the dependency among service components without expert knowledge of the running application. In this paper, we propose CloudScout, a non-intrusive approach that is capable of automatically discovering dependent service components. CloudScout analyzes the correlation among service components based on the time-series information from system monitoring logs. We address two key challenges in CloudScout: service distance calculation and dependent service clustering. We conduct experiments on five applications with 290 service components that span 20 physical hosts across two data centers. The experimental results demonstrate that CloudScout can successfully discover the dependency among service components and facilitate reducing the network latency of network applications and distributed applications.

Monitoring is the cornerstone for cloud service management, so it is significant for a cloud monitoring tool to support customization for specific monitoring requirements, to indicate the correlation between target services, and to guide adaptive service management. Unfortunately, traditional monitoring tools are always developed independently with service management platforms and are provided as self-contained softwares, which limit their capabilities on addressing these requirements. In this paper, we propose MonValley, an unified monitoring and management framework for cloud services. It consists of four components: 1) a high-level language for practitioners to express monitoring specifications on the services from all three layers, 2) a compiler to translate the expressive program into an executable program, 3) an execution engine to execute the executable program, 4) a runtime to provide supports on basic functionalities, such as data transmission. MonValley provides an innovative approach to facilitate the integrated monitoring and adaptive management for cloud services.

In cloud computing environment, an application is always composed of several service components. A collection of service components is called a service family, and we name the cloud service components as service family members. In this paper, we propose a solution named Icebreaker to assemble service components belonging to the same application without sniffing tenants' privacy. Icebreaker characterizes each service component with basic resource consuming information and proposes a new distance calculating algorithm named iEntropy to distinct service components. We adaptively adopt Affinity Propagation (AP) clustering algorithm and maximum Silhouette index to identify the number of service family and assemble the service family members. Experiments are conducted on RUBiS, Hadoop and ApacheBench clusters with 169 VMs. Evaluation results show that Icebreaker can get 96.45% accuracy.

Monitoring system provides a clear insight into the state and performance of service components in cloud computing platforms. It collects metrics from dispersed sensors and stores them in databases for show and future query. To choose the most suitable database for a monitoring system is complex, since the performance requirement on cloud monitoring system in different data centers differs widely. In this paper, we propose a benchmark named monBench to evaluate the performance of databases in cloud monitoring systems. Monbench extracts structural data from real-world monitoring logs to construct the benchmarking workload. Several performance metrics, such as throughput and query time, are evaluated by monBench.